Recently, there is an emerging interest in adversarially training a
classifier with a rejection option (also known as a selective classifier) for
boosting adversarial robustness. While rejection can incur a cost in many
applications, existing studies typically associate zero cost with rejecting
perturbed inputs, which can result in the rejection of numerous
slightly-perturbed inputs that could be correctly classified. In this work, we
study adversarially-robust classification with rejection in the stratified
rejection setting, where the rejection cost is modeled by rejection loss
functions monotonically non-increasing in the perturbation magnitude. We
theoretically analyze the stratified rejection setting and propose a novel
defense method -- Adversarial Training with Consistent Prediction-based
Rejection (CPR) -- for building a robust selective classifier. Experiments on
image datasets demonstrate that the proposed method significantly outperforms
existing methods under strong adaptive attacks. For instance, on CIFAR-10, CPR
reduces the total robust loss (for different rejection losses) by at least 7.3%
under both seen and unseen attacks.

针对分类器的对抗训练模型中的拒绝选项，根据拒绝代价模型，提出了一种新的防御方法 —— 基于一致性预测的拒绝的对抗训练模型，实验证明在强适应性攻击中具有明显的性能优势。

带有拒绝机制的分层对抗鲁棒性

Stratified Adversarial Robustness with Rejection

Correctly classifying adversarial examples is an essential but challenging
requirement for safely deploying machine learning models. As reported in
RobustBench, even the state-of-the-art adversarially trained models struggle to
exceed 67% robust test accuracy on CIFAR-10, which is far from practical. A
complementary way towards robustness is to introduce a rejection option,
allowing the model to not return predictions on uncertain inputs, where
confidence is a commonly used certainty proxy. Along with this routine, we find
that confidence and a rectified confidence (R-Con) can form two coupled
rejection metrics, which could provably distinguish wrongly classified inputs
from correctly classified ones. This intriguing property sheds light on using
coupling strategies to better detect and reject adversarial examples. We
evaluate our rectified rejection (RR) module on CIFAR-10, CIFAR-10-C, and
CIFAR-100 under several attacks including adaptive ones, and demonstrate that
the RR module is compatible with different adversarial training frameworks on
improving robustness, with little extra computation. The code is available at
this https URL

通过引入可拒绝的机制并使用置信度和修正后的置信度 (R-Con) 来提高鲁棒性，从而更好地检测和拒绝对抗样本。

两种耦合的拒绝度量可以区分对抗性样本

Two Coupled Rejection Metrics Can Tell Adversarial Examples Apart

This paper proposes a classification framework with a rejection option to
mitigate the performance deterioration caused by adversarial examples. While
recent machine learning algorithms achieve high prediction performance, they
are empirically vulnerable to adversarial examples, which are slightly
perturbed data samples that are wrongly classified. In real-world applications,
adversarial attacks using such adversarial examples could cause serious
problems. To this end, various methods are proposed to obtain a classifier that
is robust against adversarial examples. Adversarial training is one of them,
which trains a classifier to minimize the worst-case loss under adversarial
attacks. In this paper, in order to acquire a more reliable classifier against
adversarial attacks, we propose the method of Adversarial Training with a
Rejection Option (ATRO). Applying the adversarial training objective to both a
classifier and a rejection function simultaneously, classifiers trained by ATRO
can choose to abstain from classification when it has insufficient confidence
to classify a test data point. We examine the feasibility of the framework
using the surrogate maximum hinge loss and establish a generalization bound for
linear models. Furthermore, we empirically confirmed the effectiveness of ATRO
using various models and real-world datasets.

本文提出了 Adversarial Training with a Rejection Option (ATRO) 的分类框架，以减轻对抗样本带来的性能恶化问题，并在实验中证实了此方法的有效性。